AI 開發工具
GitHub Copilot CLI 1.0.83 Adds CIMD Login Support for MCP and Expands Sandbox File Tool Read Access
The new release lets MCP OAuth clients publish identity metadata at a URL, reducing the need to register individually with authorization servers. It also allows built-in sandbox file tools to read development tool configurations, including `.npmrc` files that may contain tokens, so deployers should review their default permissions.
GitHub Copilot CLI 1.0.83 updates three control planes at once: MCP identity, enterprise policy, and the local sandbox. The most significant change for interoperability is the Client ID Metadata Document (CIMD): an OAuth client can use the URL of an HTTPS document directly as its `client_id`, allowing the authorization server to retrieve information such as its name, redirect URIs, and public keys. This avoids requiring every unknown MCP client to rely on Dynamic Client Registration. It is well suited to cross-organization MCP ecosystems where no prior registration relationship exists, but only when the authorization server explicitly declares support.
CIMD is not an authentication-free mechanism. The IETF draft requires the `client_id` in the document to exactly match the document retrieval URL and requires exact matching of redirect URIs. Shared secrets and private keys must not be included in the document. Servers must also protect against SSRF, refuse to automatically follow redirects, exclude special-purpose IP addresses, and limit document size; otherwise, dynamically retrieving client metadata becomes a new attack surface in itself.
The more immediate migration risk comes from sandbox paths. Version 1.0.83 makes built-in file tools and the sandbox shell share development tool path permissions. GitHub specifically notes that these paths may include `~/.npmrc`, which can contain registry tokens. When this convenience is not needed, `sandbox.allowDevToolAccess` should be set to `false`. This improves behavioral consistency when agents read package manager configurations, but it also expands the range of secrets that prompt injection or accidental operations could access. Being readable from the sandbox should not be treated as meaning that data can safely be sent to the model or included in tool output.
The release also fixes a race condition in which MCP servers blocked by enterprise policy could start before managed policies had finished loading. It adds HTTPS proxy mTLS, repository-account-based injection of `gh` credentials, and model candidate lists for custom agents. When upgrading, engineering teams should test policy enforcement during cold starts, inventory development tool credentials, and verify that CIMD authorization servers implement complete URL and SSRF validation—not merely confirm that the login flow succeeds.